The default umask for system and users must be 077.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-216341 | SRG-OS-000480 | SOL-11.1-040250 | SV-216341r959010_rule | 2024-11-25 | 3 |
| Description |
|---|
| Setting a very secure default value for umask ensures that users make a conscious choice about their file permissions. |
| ℹ️ Check |
|---|
| The root role is required. Determine if the default umask is configured properly. # grep -i "^UMASK=" /etc/default/login If "UMASK=077" is not displayed, this is a finding. Check local initialization files: # cut -d: -f1 /etc/passwd | xargs -n1 -iUSER sh -c "grep umask ~USER/.*" If this command does not output a line indicating "umask 077" for each user, this is a finding. |
| ✔️ Fix |
|---|
| The root role is required. Edit local and global initialization files containing "umask" and change them to use 077. # pfedit /etc/default/login Insert the line UMASK=077 # pfedit [user initialization file] Insert the line umask 077 |